Brett Glass wrote this message on Mon, Sep 19, 2005 at 01:32 -0600:
> At 12:56 AM 9/19/2005, Luigi Rizzo wrote:
>
> >[see long original request below]
> >
> >Bret, you want a block structured ipfw control language, but
> >ipfw is an assembly language. You have to live with that.
> >Your only way out is
> >A. write a translator from high level to low level language
> > (many people do use sh scripts to generate ipfw configurations)
>
> I've tried this. Alas, it quickly gets out of hand because objects
> in IPFW (for example pipes) aren't named. You wind up literally
> having to build a symbol table to keep track of rule numbers, pipe
> numbers, etc. Yes, you can do it, but it's very awkward.
What's awkward about:
#define PIPE_FOO 1
#define PIPE_BAR 2
add pipe PIPE_FOO config bw 64kbit/sec
/* ... etc ... */
??
There's this nice option -p that passes your firewall file through a
preprocessor.. and cpp is quite nice for this...
I little bit of my firewall.conf:
#ifndef SET
#define SET
#endif
/* little useful macros */
#if 1
#define DENY deny
#else
#define DENY skipto BLACKHOLE
#endif
/* Defines for rules */
#if 0
#define IPSEC(x) x
#else
#define IPSEC(x)
#endif
#if 1
#define PIF vlan0
#define PIP 69.17.45.168
#define PNET 69.17.45.0/24
#define PUB(x) x
#else
#define PUB(x)
#endif
[...]
/* labels */
#define DIVERT 15900
#define BLACKHOLE 65000
#define THEEND BLACKHOLE
#define DECL(x) add x SET count ip from any to any
#define GOTO_THEEND add SET skipto THEEND ip from any to any
/* nat */
DECL(DIVERT)
PUB(add SET divert 8668 ip from any to any via PIF)
MAN(add SET divert 8669 ip from any to any via MIF)
This lets me enable/disable parts of my configuration a lot easier...
and use those symbols you like to use... :)
and to enable all this:
firewall_flags="-p /usr/bin/cpp" # Flags passed to ipfw when type is a file
--
John-Mark Gurney Voice: +1 415 225 5579
"All that I will do, has been done, All that I have, has not."
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
